Dysfunctional Programming

Session-Management on Linux

One thing I always admired on linux is fast session-switching. A simple key-press (ctrl+alt+Fx) and I can ditch my current session to switch to another one. While in principle session-interaction is fairly simple, you can easily get it wrong (as can be seen with XMir). But how exactly does session management work today? And how did systemd-logind change this situation?

First, we need to define a session. A session is a group of processes running under control of a single user. Only a single session is active on a system (more precisely on a seat; discussed below) and a user can only interact with the active (or foreground) session. A session can start and stop processes, but it cannot escape from the session. In other words, all started processes will always belong to the session they were started in. Only system-daemons (which are not attached to a session) can spawn new sessions.

A session usually has different user-daemons which provide services for the session. For instance, the X-Server provides graphics access to other session-processes, pulseaudio provides audio-access. Then there is a central process which controls and monitors a session. Whenever a session is spawned, this process is the first process that is created. It initializes the session, spawns other management processes and optionally restarts them if they crash. It might also exit once the session was initialized if no process-monitoring is required. An example would be gnome-session.

1) Session Management

Historically, every process on a system has a session-id which defines the session a process belongs to. The setsid() system call allows to create a new session. However, with systemd-logind a new more-versatile concept was introduced. To understand this, we need to first look at seats.

Seats

Multi-seat setup (source: Wikipedia)

On normal systems only a single seat exists (called seat0). But more seats can be created on request. A seat is a virtual object that describe a physical interface to a system. The combination of a monitor plus keyboard and mouse form a usual seat. One user can interact with the system through this seat. If you attach another monitor plus keyboard and mouse, another user can interact with the system in parallel via this new seat (eg., called seat1). It is important to note that these seats are independent of each other. The pictures you get on the monitors are different and keyboard input from one seat doesn’t affect the other.

Any device connected to your system can be attached to a seat, but only to one seat at a time! If a device is attached to seat, it cannot be used by processes running on another seat. Obviously, input devices, sound-devices and monitors are usually attached to a seat. Network-interfaces, for example, can be left unattached so all seats can share an internet-connection. It is up to the system-administrator to decide which devices to attach to which seat, or whether to leave them as global devices that can be shared.

Bootup

During system-boot, systemd starts several daemons to manage a system. All these daemons are global and not attached to a seat or session. This also means, these daemons must not access devices attached to a seat. Among these daemons is also systemd-logind, which is responsible for session and seat management.

To allow user interaction, systemd needs to automatically spawn a new session for each seat. This is usually a login-session (like gdm, kdm or LightDM) but might also be configured as auto-login and spawn directly a user-session like gnome-session. In case of a login-session, the greeter draws login and password fields and after verifying the input, it instructs systemd to spawn a user-session. Note that the greeter cannot start the user-session itself as it already runs in a session (you cannot escape your session, remember?).

But what exactly does systemd do to control sessions?

Sessions

Via kernel interfaces (namely cgroups) systemd can reliably track processes and their childs. Whenever systemd is instructed to start a new session, it first verifies the caller is allowed to do that and then it spawns the first process for the session. Internally, it attaches a new session-id to this process, saves the seat this session is run on and some other maintenance data. Whenever this session process creates new processes, systemd can use cgroups to track these. So it always knows which session a process belongs to.

The first process for a session is responsible of initializing the session. In case of gnome-session, it spawns the X-Server, some gnome-specific maintenance daemons and then monitors the session in case something goes wrong. You can now interact with this session (normally through the X-Server) and do your daily work.

A session can explicitly instruct systemd to close itself. However, this will only mark it as dead. Once all processes of a session exited, the session is automatically cleaned up and removed.

2) Case-Study: Text-mode sessions

Text-mode interface (source: Wikipedia)

As a concrete non-trivial scenario, I’ll explain how text-mode sessions integrate with this. First, we need to know that virtual-terminals are basically a combination of input devices and a monitor. They can be accessed via /dev/tty<num> (where <num> is between 1 and 63; the other /dev/ttyXY devices are no VTs!). If you read from them, you get input from connected keyboards, if you write to them, the kernel displays it as text on the monitor. Some rather complex control-sequences are available to do colors or more, but that’s beyond the scope. VTs are always bound to seat0. So only sessions on this seat can use VTs (which means, classic text-mode is only available on seat0).

Text-mode sessions are special in that they are not spawned by a login-session. systemd-logind spawns /bin/agetty right during boot for each VT (you can configure how many of the 63 possible should be started). agetty is running as system daemon and not in a session! However, it is bound to seat0, obviously. agetty initializes the VT and runs /bin/login. login then writes a greeter to the VT and reads username plus password from it. As you might notice, this is problematic as it accesses devices attached to a seat even though it’s not running in a session. But due to the design of VTs, this cannot be easily avoided.

Once loginverified the user-input, it instructs systemd to start the given user-session in text-mode. It looks up the initial process in /etc/passwd (let’s assume it is /bin/bash) and runs it. So bash is the controlling process in this session. It also substitutes the X-Server in that it provides user-interaction (in text mode rather than graphics). It allows to switch between different processes (ctrl+Z, fg, bg and jobs) and allows starting other session-daemons during initialization (via .bashrc).

So while text-mode feels a lot different, it is in fact very similar to graphics mode and is internally handled almost equally.

3) Multi-Session

We now understand what a session is, how they are created and how a user interacts with them. However, we haven’t discussed what happens if there are multiple sessions on a seat.

On current systems, multiple sessions are only allowed on seat0 if VTs are enabled (which is usually the case). That means, on all other seats, once you spawned a session, you have to stick with it. You cannot ctrl+alt+Fx away from the session (the reason for this is historical and we’re about to change this). However, you can close the session and then start a new one.

But if we assume our seat supports multiple sessions, how does that work? systemd-logind is responsible to manage and track sessions. Therefore, it keeps an Active attribute for each session. It’s a boolean value that defines whether the session is currently active or not. systemd-logind takes care that always at mostone session is active. If no session runs on a seat, no session might be active (also in other situations which we ignore here as it’s an implementation detail). Additionally, systemd-logind sets the correct access-restrictions on devices attached to a seat so only the active session can access these devices. This guarantees that no background session interferes with foreground activity.

To switch between sessions, each session has to listen for special keyboard input (normally ctrl+alt+Fx) and instruct systemd-logind to switch to another session once it’s pressed. Today, this is implemented in the X-Server or, if no x-server runs in the session, by the underlying VT. You can also send a dbus call to systemd-logind directly to perform the session-switch (see loginctl activate <sid>).

So for proper multi-session support, a login-session spawns a user-session during login but stays active in background. A user can now switch between the user-session and the login-session and optionally spawn additional session by logging in again. Session processes can listen for dbus signals from systemd-logind to be notified when they are activated or deactivated. This allows them to go asleep while being in background and start up again once being put in foreground.

Post navigation

11 thoughts on “Session-Management on Linux”

Thanks for the write-up. Two things: can you elaborate on what work is being done to enable seat>0 session switching, and can you write something about how and why consolekit failed and systemd just steamrolled over it?

Regarding consolekit: I have honestly no idea. Maybe the reason is cgroups. They allow *reliable* process tracking which wasn’t possible before. In fact, any session-management without it is as horrible as with getsid(). But maybe consolekit was just written at the wrong time.. Who knows? logind emerged at a time at which most other stuff has been already figured out. XServer finally works without any major problems thanks to KMS (remember the VT switching in the old days?). Sessions itself have adopted dbus and provide any major infrastructure today.
Or maybe because logind got pushed harder?

I can’t speak about ConsoleKit specifically, but pretty much all of these system daemons have been through at least two generations – one that basically worked but not always well, then a followup that learned from the mistakes of the first attempt. HAL gave way to DeviceKit (which eventually rolled into UDEV), the first PolicyKit was replaced with polkitd, etc.

The way I see this, ConsoleKit was the first attempt to fix this up properly, and while it worked better than what existed before, the developers learned a lot from what didn’t work. Logind is effectively the second generation of that – it’s not really that systemd displaced consolekit, so much as absorbed it…

Thanks. Yeah, what’s confusing to me is that it seems systemd as a whole is now a required part of everything, instead of just systemd-logind. I’m going to have to migrate a bunch of machines from openrc and… meh.

No it’s not historically true. With old unix machines you can just run setsid() and your process will be part of a new session. However, even then, you couldn’t set your session-id directly. That is, either keep your sid or create a new one. You cannot move a process from one session to another.

What reptyr does is moving a process from one terminal to another. As long as both terminals run in the same session, you’re fine. If both terminals run in different sessions, it will still work, but the underlying process will stay in its session.

GNU-screen is somewhat different. Whenever you run GNU-screen, you run it from within a session. For instance if you SSH into a machine, the SSH server will start a new session for you. If you start GNU-screen from within it, it is obviously part of this session. If you run a program inside of GNU-screen, it also is part of the session. So once you disconnect from SSH, GNU-screen will keep staying around and making sure your session stays alive.
Once you SSH into your system again, the SSH server will spawn a new session for you, independent of the old. If you now reattach to your old program via GNU-screen, it will still work. However, it will now run in a different session than your active SSH session. It forwards the screen content via GNU-screen to your session so you can interact with it. But it isn’t part of your session!

So whether it’s GNU-screen or reptyr, all they do is re-routing TTY streams. Whether the processes on both ends of the TTY are in a different session or in the same doesn’t matter.

I was thinking of seats based on the definition: “seat is a virtual object that describe a physical interface to a system” and sessions as a group of processes, designated by their having a session id, that are attached to a seat. I thought the wording I choose made the concept a bit clearer, but obviously I was wrong!
So, let’s try this: the same session attached to two different seats, but where the monitor could be shared by both keyboards/mice.
You say above that a device can be attached to, at most, one seat, but you also said that you can share devices across seats (like the network adaptor example) and such devices become system level. The devices that attached to the system are determined by the admin, so I wanted to know, essentially, if the monitor could become a system level device, and additional input devices could be added to an existing session such that you have multiple pointer. I’m pretty sure X can do this (via multi-pointer X, I think), but it doesn’t seem as though this can be done with what you’ve described above.
This would be most useful in the cases of collaboration (but also extremely useful for teaching purposes) where two, or more, people are able to interact with the same screen.
You can do this remotely with “shared” X sessions (the experience is far from great, however), but I’ve found myself with the need to do the same but with both parties using the same monitor and each with their own keyboard/mouse attached to the same pc.
I hope that makes things clearer.

Ok, now I can follow. Yes, this is of course possible. What you describe is two people using one seat. I didn’t describe that use-case, you are right. On the system-level, this is handled the same as if it was only one person. So we don’t care how many people use one physical-interface and we don’t care how many pointers float on its screen. That is up to the session.

I don’t know how X11 does it, but I know that Wayland provides support for that. It simply splits up the devices in the session into multiple “wl_seat” objects. Unfortunately, this name collides with “system seats”. They’re basically the same, but placed differently in the hierarchy. System-seats describe independent interfaces to a system. Session-seats describe different interfaces to a session.

So if we assume two people work together in one session, they would form two different session-seats, but one system-seat.
Generally, if someone speaks of “seats”, they talk about system-seats.

Wow, it wasn’t at all obvious, to me, that the various hids attached to a pc would all be considered one seat, but I’d also not heard of session vs. system seats either, so… :)
Thanks for explaining how logind would handle it.